In February 2011, Michaels Stores and its Aaron Brothers stores reported a compromise involving debit-card terminals in 20 U.S. states. The company warned customers who had made PIN-based purchases between February 8 and May 6, 2011, that their payment information may have been exposed. The source does not identify the attacker, specify the technical intrusion method, or establish how many customers were affected.
A class-action lawsuit was filed against Michaels in the County Court of Passaic, New Jersey, over the incident. The disclosure illustrates the risk created when retail point-of-sale systems handle payment-card and PIN data, but the supplied account does not provide a final court judgment, settlement amount, regulatory penalty, or finding that named executives directed or concealed the compromise. The documented aftermath is therefore limited to customer notification and the civil litigation described above.
